.gz file not getting indexed in splunk

[beenagulzar]

i am getting this error , every time when i am indexing the .csv.gz file
updated less than 10000ms ago, will not read it until it stops changing.
has stopped changing , will read it now .

inputs.conf :
[monitor:///tmp/*.csv.gz]
sourcetype=test

props.conf:
[test]
CHECK_FOR_HEADER = true
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
disabled = false
REPORT-AutoHeader = AutoHeader-6
category = Structured

[dbcase]

The line

crcSalt=/tmp/.csv.gz

is incorrect

please use (verbatium)

crcSalt= <SOURCE>

[beenagulzar]

i have added the crcsalt file like below

[monitor:///tmp/.csv.gz]
sourcetype=test
crcSalt=/tmp/.csv.gz
ignoreOlderThan=1d

but still i cant see todays sample1.csv.gz file

in log file i can find out

Handling file =/tmp/sample1.csv.gz
ArchivedProcessor - reading Path = /tmp/sample1.csv.gz ( seek=0 len=142048)

but not seeing the data in the splunk indexer.

its showing handling file , reading file but not seeign finished processing file . Kindly need your input .

[dbcase]

try crcSalt= <SOURCE> in your inputs.conf, also you may want to use batch instead of monitor with a move_policy = sinkhole so it will erase the previous file when indexed.

[martin_mueller]

That's not an error, Splunk is informing you that it's not going to read the archive until it's confident that the archive has stopped changing.

[beenagulzar]

No , my env is , everyday new file will be added in that location to monitor , e.g. /tmp/sample1.csv.gz ... , sample2.csv.gz ....only first time it went through ... from day 2 always it's throwing the same info but no data in the indexer . My sample1.csv.gz has the first line in common like same fields everyday .. but from the second line it's different ... is it because of that ... u can find my props.conf and my inputs.conf in my first post .

[martin_mueller]

So... when you run this over all time, you see nothing? index=main sourcetype=test

Anything here? index=_internal group=per_source_thruput series=*csv.gz*

[beenagulzar]

No , just showing read it now ... but I am not seeing any data in the indexer , from this particular source.